34 lines
1.2 KiB
Diff
34 lines
1.2 KiB
Diff
# UNDF: UNDF-2026-000000300
|
|
diff --git a/src/build.c b/src/build.c
|
|
index abcdef..123456 100644
|
|
--- a/src/build.c
|
|
+++ b/src/build.c
|
|
@@ -3680,16 +3680,18 @@ void sqlite3CreateForeignKey(
|
|
if( pFromCol==0 ){
|
|
pFKey->aCol[0].iFrom = p->nCol-1;
|
|
}else{
|
|
for(i=0; i<nCol; i++){
|
|
- int j;
|
|
- for(j=0; j<p->nCol; j++){
|
|
- if( sqlite3StrICmp(p->aCol[j].zCnName, pFromCol->a[i].zEName)==0 ){
|
|
- pFKey->aCol[i].iFrom = j;
|
|
- break;
|
|
- }
|
|
- }
|
|
- if( j>=p->nCol ){
|
|
+ /* CWE-407 fix (sqlite-0003, build.c:3680):
|
|
+ ** Replace O(p->nCol) sqlite3StrICmp inner loop with O(1) hash-based
|
|
+ ** sqlite3ColumnIndex(). The table p->aHx[] is fully populated by
|
|
+ ** the time FK clauses are parsed (columns precede REFERENCES in SQL).
|
|
+ */
|
|
+ int j = sqlite3ColumnIndex(p, pFromCol->a[i].zEName);
|
|
+ if( j<0 ){
|
|
sqlite3ErrorMsg(pParse,
|
|
"unknown column \"%s\" in foreign key definition",
|
|
pFromCol->a[i].zEName);
|
|
goto fk_end;
|
|
+ }else{
|
|
+ pFKey->aCol[i].iFrom = j;
|
|
}
|
|
if( IN_RENAME_OBJECT ){
|
|
sqlite3RenameTokenRemap(pParse, &pFKey->aCol[i], pFromCol->a[i].zEName);
|